Z-blogphp@1.5.1 Security Vulnerabilities and Issues — Z-blogphp@1.5.1 CVE List

Lucene search

ZblogcnZ-blogphp1.5.1

5 matches found

CVE•added 2018/02/08 4:29 p.m.•41 views

CVE-2018-6846

Z-BlogPHP 1.5.1 allows remote attackers to discover the full path via a direct request to zb_system/function/lib/upload.php.

5.3CVSS5.3AI score0.00205EPSS

CVE•added 2018/03/31 10:29 p.m.•39 views

CVE-2018-8893

Z-BlogPHP 1.5.1 Zero has CSRF in plugin_edit.php, resulting in the ability to execute arbitrary PHP code.

8.8CVSS7.5AI score0.00141EPSS

CVE•added 2018/04/16 9:58 a.m.•36 views

CVE-2018-9169

Z-BlogPHP 1.5.1 has XSS via the zb_users/plugin/AppCentre/plugin_edit.php app_id parameter. The component must be accessed directly by an administrator, or through CSRF.

4.8CVSS4.9AI score0.00207EPSS

CVE•added 2018/02/06 2:29 p.m.•30 views

CVE-2018-6656

Z-BlogPHP 1.5.1 has CSRF via zb_users/plugin/AppCentre/app_del.php, as demonstrated by deleting files and directories.

6.5CVSS6.5AI score0.00098EPSS

CVE•added 2018/04/16 9:58 a.m.•30 views

CVE-2018-9153

The plugin upload component in Z-BlogPHP 1.5.1 allows remote attackers to execute arbitrary PHP code via the app_id parameter to zb_users/plugin/AppCentre/plugin_edit.php because of an unanchored regular expression, a different vulnerability than CVE-2018-8893. The component must be accessed direct...

7.2CVSS8.2AI score0.00682EPSS